Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2226641/?format=api
{ "id": 2226641, "url": "http://patchwork.ozlabs.org/api/patches/2226641/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-um/patch/20260423-fix_exitcode-v1-1-7e4508913d68@cherr.cc/", "project": { "id": 60, "url": "http://patchwork.ozlabs.org/api/projects/60/?format=api", "name": "User-mode Linux Development", "link_name": "linux-um", "list_id": "linux-um.lists.infradead.org", "list_email": "linux-um@lists.infradead.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260423-fix_exitcode-v1-1-7e4508913d68@cherr.cc>", "list_archive_url": null, "date": "2026-04-22T17:39:25", "name": "um: proc/exitcode: fix simple_strtol() out-of-bounds read", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "10cb7ec04fedcfd46e1dd0ed982cbfc768bb1934", "submitter": { "id": 93227, "url": "http://patchwork.ozlabs.org/api/people/93227/?format=api", "name": "Shengzhuo Wei", "email": "me@cherr.cc" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/linux-um/patch/20260423-fix_exitcode-v1-1-7e4508913d68@cherr.cc/mbox/", "series": [ { "id": 501053, "url": "http://patchwork.ozlabs.org/api/series/501053/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-um/list/?series=501053", "date": "2026-04-22T17:39:25", "name": "um: proc/exitcode: fix simple_strtol() out-of-bounds read", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/501053/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2226641/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2226641/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <linux-um-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n secure) header.d=lists.infradead.org header.i=@lists.infradead.org\n header.a=rsa-sha256 header.s=bombadil.20210309 header.b=BWkXwhpl;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=cherr.cc header.i=@cherr.cc header.a=rsa-sha256\n header.s=feishu2604220257 header.b=VjNHg5eN;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=none (no SPF record) smtp.mailfrom=lists.infradead.org\n (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org;\n envelope-from=linux-um-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from bombadil.infradead.org (bombadil.infradead.org\n [IPv6:2607:7c80:54:3::133])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g161W0zLPz1y2d\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 23 Apr 2026 03:39:54 +1000 (AEST)", "from localhost ([::1] helo=bombadil.infradead.org)\n\tby bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux))\n\tid 1wFbYE-0000000AaEH-00ro;\n\tWed, 22 Apr 2026 17:39:50 +0000", "from va-2-20.ptr.blmpb.com ([209.127.231.20])\n\tby bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux))\n\tid 1wFbYB-0000000AaDu-1R8Z\n\tfor linux-um@lists.infradead.org;\n\tWed, 22 Apr 2026 17:39:49 +0000", "from pve.cherr ([111.42.148.201]) by smtp.feishu.cn with ESMTPS;\n Thu, 23 Apr 2026 01:39:35 +0800" ], "DKIM-Signature": [ "v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;\n\td=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help\n\t:List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding:Cc\n\t:Message-Id:From:Subject:Content-Type:Date:To:Mime-Version:Reply-To:\n\tContent-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:\n\tResent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner;\n\tbh=qs9GUd9BD+oZzLK/vsuOICM6KBilsRgKUVepBg7QJJ4=; b=BWkXwhplSxzhEFq+rhoOFASXYm\n\tEjmE7/yyZ+2uA92femd2CPcRqyDzNzIsnf0CFuNDHvalFUVnJz0AJic3h6kVhrH2YANIO8Hko0ZC9\n\thdXVWiQG6hSDyoX9HB+y/pbnbrvT9sLl10hmuIQu/eUFq6gmF1KnBX1KFks7KXcGgwgYPHizct9V/\n\tcka84v3cjc6KiLsyp7y/MoUw3G/9LmiZphJPJLhcMA8BY+3/tgh3whxyg0GXmiW6FzrAPYr3cojqp\n\tQzBsukfssh7Qhdte6mspNh8OtDSioFHHtCNDGX+Ao6NKNe2tCQzJb4DIZhyHqIkZ/LsOXAFC1tdvq\n\tYIKMmDwg==;", "v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;\n s=feishu2604220257; d=cherr.cc; t=1776879578; h=from:subject:\n mime-version:from:date:message-id:subject:to:cc:reply-to:content-type:\n mime-version:in-reply-to:message-id;\n bh=qs9GUd9BD+oZzLK/vsuOICM6KBilsRgKUVepBg7QJJ4=;\n b=VjNHg5eN6T0G/5JprjMthUuKi6Uyguf47P3dOu7gMc0GL5B3dzqKUNRmsT6ouj6DLhtwSR\n chUfZKWJ/IGtbBCHYuESa69k98+Kn8Sxy6L9VvfSZh3zcVPhWKSjh4WhycxSXOxrrdn3x+\n NkciWOyQtzvOtQR0VF+8m0sI59dNnH+kd65LJkRocsaxAyxyvSqyZhYjUTissFE9I6/cCb\n w51spGerxQsO3Y8SPdIBxWMXStI7yT7D+6EmbomH4fxSTw/6HvRVdWGlyL9EMu2j0lQnSa\n mEqXHPStFnpC4NzSLnktt0WuZ9CsFCWiXHpaPPrIh/Y246NngI2HYVlWLLyiaA==" ], "Mime-Version": "1.0", "X-B4-Tracking": "v=1;\n b=H4sIAMwH6WkC/x2MQQqAIBQFrxJ/naAWUl0lIsJe9TcaGiGId09aD sNMpojAiDQ1mQJejuxdBdU2ZK/NnRC8VyYttZG97sTBaUXix/odYpSDNAoWRvdUkzug+n83L6V\n 8yBJH+F4AAAA=", "X-Mailer": "b4 0.14.2", "X-Original-From": "Shengzhuo Wei <me@cherr.cc>", "To": "\"Richard Weinberger\" <richard@nod.at>,\n\t\"Anton Ivanov\" <anton.ivanov@cambridgegreys.com>,\n\t\"Johannes Berg\" <johannes@sipsolutions.net>,\n\t\"Dan Carpenter\" <error27@gmail.com>,\n\t\"Andrew Morton\" <akpm@linux-foundation.org>,\n\t\"Jeff Dike\" <jdike@addtoit.com>", "Date": "Thu, 23 Apr 2026 01:39:25 +0800", "X-Change-Id": "20260423-fix_exitcode-908061ece624", "Content-Type": "text/plain; charset=UTF-8", "Subject": "[PATCH] um: proc/exitcode: fix simple_strtol() out-of-bounds read", "X-Lms-Return-Path": "<lba+269e907d8+6a09fa+lists.infradead.org+me@cherr.cc>", "From": "\"Shengzhuo Wei\" <me@cherr.cc>", "Message-Id": "<20260423-fix_exitcode-v1-1-7e4508913d68@cherr.cc>", "Cc": "<linux-um@lists.infradead.org>, <linux-kernel@vger.kernel.org>,\n\t\"Shengzhuo Wei\" <me@cherr.cc>", "Content-Transfer-Encoding": "7bit", "X-CRM114-Version": "20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 ", "X-CRM114-CacheID": "sfid-20260422_103947_466727_CA3B0926 ", "X-CRM114-Status": "GOOD ( 10.25 )", "X-Spam-Score": "-2.1 (--)", "X-Spam-Report": "Spam detection software,\n running on the system \"bombadil.infradead.org\",\n has NOT identified this incoming email as spam. The original\n message has been attached to this so you can view it or label\n similar future email. If you have any questions, see\n the administrator of that system for details.\n Content preview: The stack buffer 'buf' is declared as\n char[sizeof(\"nnnnn\\0\")]\n (7 bytes) and the copy size is min(count, sizeof(buf)). When a user writes\n 7 or more bytes, copy_from_user fills all 7 bytes without a NUL [...]\n Content analysis details: (-2.1 points, 5.0 required)\n pts rule name description\n ---- ----------------------\n --------------------------------------------------\n 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record\n -0.0 SPF_PASS SPF: sender matches SPF record\n -0.1 DKIM_VALID Message has at least one valid DKIM or DK\n signature\n -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from\n author's\n domain\n -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from\n envelope-from domain\n 0.1 DKIM_SIGNED Message has a DKIM or DK signature,\n not necessarily valid\n -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%\n [score: 0.0000]", "X-BeenThere": "linux-um@lists.infradead.org", "X-Mailman-Version": "2.1.34", "Precedence": "list", "List-Id": "<linux-um.lists.infradead.org>", "List-Unsubscribe": "<http://lists.infradead.org/mailman/options/linux-um>,\n <mailto:linux-um-request@lists.infradead.org?subject=unsubscribe>", "List-Archive": "<http://lists.infradead.org/pipermail/linux-um/>", "List-Post": "<mailto:linux-um@lists.infradead.org>", "List-Help": "<mailto:linux-um-request@lists.infradead.org?subject=help>", "List-Subscribe": "<http://lists.infradead.org/mailman/listinfo/linux-um>,\n <mailto:linux-um-request@lists.infradead.org?subject=subscribe>", "Sender": "\"linux-um\" <linux-um-bounces@lists.infradead.org>", "Errors-To": "linux-um-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org" }, "content": "The stack buffer 'buf' is declared as char[sizeof(\"nnnnn\\0\")] (7 bytes)\nand the copy size is min(count, sizeof(buf)). When a user writes 7 or\nmore bytes, copy_from_user fills all 7 bytes without a NUL terminator.\nThe subsequent call to simple_strtol() expects a NUL-terminated string\nand will read past the end of buf on the stack.\n\nwrite(2) should report the number of bytes consumed. Returning the original\ncount would claim success even when the input was truncated, so userspace\ncannot detect it.\n\nClamp the copy length to sizeof(buf)-1, add a terminator, and return the\nconsumed length.\n\nFixes: 201f99f170df (\"uml: check length in exitcode_proc_write()\")\nFixes: e16f5350d4cf (\"uml: get declaration of simple_strtoul\")\nSigned-off-by: Shengzhuo Wei <me@cherr.cc>\n---\n arch/um/kernel/exitcode.c | 5 +++--\n 1 file changed, 3 insertions(+), 2 deletions(-)\n\n\n---\nbase-commit: 6596a02b207886e9e00bb0161c7fd59fea53c081\nchange-id: 20260423-fix_exitcode-908061ece624\n\nBest regards,", "diff": "diff --git a/arch/um/kernel/exitcode.c b/arch/um/kernel/exitcode.c\nindex 43edc2aa57e4fbd4a3d24f96878c76f9f8fd4eaa..8de404ff21a213918c5351bc20a6e047bf1b93f5 100644\n--- a/arch/um/kernel/exitcode.c\n+++ b/arch/um/kernel/exitcode.c\n@@ -43,16 +43,17 @@ static ssize_t exitcode_proc_write(struct file *file,\n \tsize_t size;\n \tint tmp;\n \n-\tsize = min(count, sizeof(buf));\n+\tsize = min(count, sizeof(buf) - 1);\n \tif (copy_from_user(buf, buffer, size))\n \t\treturn -EFAULT;\n+\tbuf[size] = '\\0';\n \n \ttmp = simple_strtol(buf, &end, 0);\n \tif ((*end != '\\0') && !isspace(*end))\n \t\treturn -EINVAL;\n \n \tuml_exitcode = tmp;\n-\treturn count;\n+\treturn size;\n }\n \n static const struct proc_ops exitcode_proc_ops = {\n", "prefixes": [] }